Modified versions of Nukebot Trojan spotted in wild after code leak

Apparently, different cyber gangs are using modified versions of the Nukebot in wild after code Leak occurred in March 2017.

Crooks are adapting the leaked source code for the Nukebot banking Trojan to target banks in the United States and France and to steal mail client and browser passwords.

Apparently, different cyber gangs are using modified versions of the Nukebot in wild since its source code was leaked leak in March.

In March, the source code for a new banking Trojan, dubbed Nuclear Bot (Nukebot ), was available for sale in the cyber criminal underground.The Nuclear Bot banking Trojan first appeared in the cybercrime forums in early December when it was offered for $2,500. The malicious code implements some features commonly seen in banking Trojans, it is able to inject code in Mozilla Firefox, Internet Explorer and Google Chrome browsers and steal sensitive data provided by the users.

The Trojan can also open a local proxy or hidden remote desktop service to allow crooks to initiate rogue transactions through the victims’ browsers after they have been tricked into providing the second authentication factor.

The creator of the malware lost his credibility over the months and has been flagged as a scammer in the hacking community. The malware author did not offer a test version of the malware to potential buyers and advertised the Nuclear Bot using different names on different cybercrime forums.

In order to gain credibility and notoriety in the cyber crime underground he released the Trojan’s source code.

The NukeBot Trojan appears as a powerful tool written from scratch and that was able in early stage attacks to avoid detection of antivirus solutions.

Now malware experts from Kaspersky Lab have detected several compiled samples of Nukebot Trojan created since March, many of which appear to be test samples.

“The publication of malware source code may be nothing new, but it still attracts attention from across the IT community and some of that attention usually goes beyond just inspecting the code. The NukeBot case was no exception: we managed to get our hands on a number of compiled samples of the Trojan. ” wrote experts from Kaspersky.

“Most of them were of no interest, as they stated local subnet addresses or ‘localhost/127.0.0.1’ as the C&C address. Far fewer samples had ‘genuine’ addresses and were ‘operational.’”

The analysis of compiled samples revealed that only five percent were being used in real attacks, but there is no information about the campaign leveraging these samples.

The implementations of web injections in the source code confirm that hackers are using it to target banks in France and the U.S.

Researchers extracted the IP addresses of the command and control servers from the code from some plait-text version they were in possession. Obviously, the operational versions of Nukebot were encrypted, this means that the researchers need to extract the keys in order to decode it.

“In order to trigger web injections, we had to imitate interaction with C&C servers. The C&C addresses can be obtained from the string initialization procedure,” continues the analysis. “When first contacting a C&C, the bot is sent an RC4 key which it uses to decrypt injections. We used this simple logic when implementing an imitation bot, and managed to collect web injections from a large number of servers.

“Initially, the majority of botnets only received test injects that were of no interest to us,” Yunakovsky said. Later, however, we identified a number of NukeBot’s ‘combat versions.’”

Experts also noticed that some modified versions of Nukebot did not have web injections, these variants are delivered via droppers, and once they are unpacked, the malicious code downloads a number of password recovery utilities from a remote server under the attacker’s control.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – malware, Nuclear Bot banking Trojan)

[adrotate banner=”13″]